PHP Security Vulnerabilities: an update for Cezanne customers

In brief: On 21 October 2026, A group of cyber-security researchers and organisations disclosed two vulnerabilities within PHP this week, which they warned could have the potential to upend sites across the internet.

As a result, PHP emergency fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, also known as "PHP2Shell") were released. We applied the updates to every environment supporting Cezanne Recruitment the same day. Cezanne HR, Payroll and Learning don't use PHP and aren't affected, and we've found no evidence that the vulnerabilities were exploited in our services. You don't need to take any action and we're continuing to monitor.

So, what happened?

On 21 October 2026, the PHP released emergency security updates for two critical vulnerabilities in PHP. PHP is a programming language that powers a large share of the web applications in use today - you can read in more detail about what it is and what it does here.

Details of the flaws became public shortly before the fixes were released, so organisations across the industry treated updating as urgent. If left unpatched, the vulnerabilities could allow an attacker to run code on an affected web server. Government security agencies, including the US Cybersecurity and Infrastructure Security Agency (CISA) and CERT-EU, issued advisories urging organisations to update straight away.

Which Cezanne products were affected?

Cezanne Recruitment is the only part of our platform that uses PHP, so it was the only product we needed to update. Cezanne's HR software, Payroll and Learning are built on different technology and weren't affected by these vulnerabilities. If you use any of those products, nothing about your service has changed.

What did we do?

Our engineering team reviewed the advisory as soon as it was published. We applied the required security updates across all environments supporting Cezanne Recruitment on 21 October 2026, the same day the fixes became available. We've found no evidence that the vulnerabilities were exploited in any of our services. However, we'll keep monitoring closely for further advisories and update this page if anything changes.

I'm a Cezanne customer - do I need to do anything?

No, you don't need to take any action. You can keep using Cezanne Recruitment, our HR software, Payroll and LMS as normal. If you have questions about this update, or your organisation needs anything for its own security records, just get in touch with our Customer Success Team who'll be happy to help. We have also published an update on our Knowledge Base.